Bug fix
## What is the current behavior?
Read-only users cannot download files because the download feature
requires minting a temporary API key, which is properly blocked for
read-only users.
## What is the new behavior?
Instead of using temporary API keys, we now create signed URLs for the
files to be downloaded. We batch-create signed URLs for an entire
folder's worth of files, requiring only a single management API call,
then use those signed URLs to download the files. This allows read-only
users to download files without needing elevated permissions.
## Additional context
Resolves FE-2737
## Context
Taking a slightly different approach to [this
PR](https://github.com/supabase/supabase/pull/43370)
Original problem was that if you opened some folders while in a bucket
and then switched to a different bucket, the folder UI will persists
(folders from Bucket A will render when landing on Bucket B)
## Changes involved
- Shift `StorageExplorerStateContextProvider` into `[bucketId].tsx]`
instead of `ProjectContext`
- The valtio store here only applies for the storage explorer so having
it so high in the project's context was unnecessary
- This also just implies that the valtio store will automatically reset
whenever the bucket changes
- Simplify storage explorer valtio store by initializing the store with
the bucket
- We'll initialize the selected bucket with the store now (Same as
previous PR)
- Removes unnecessary `setSelectedBucket` method which required a
separate `useEffect` in `StorageExplorer.tsx`
## To test
- [ ] Verify that the original is resolved
- [ ] General smoke test of the storage explorer - i've also re-added
the e2e test that Gildas wrote up in his PR
## Problem
When navigating between buckets after having selected a folder, the
storage view shows the previous folder content.
## Solution
Set the selected bucket before navigating to it, preventing a race
condition with Valtio updates and the effect that loads the bucket
content.
## How to test
1. Create 2 buckets
2. In one of them, create a folder and upload some files
3. Go back to the bucket list
4. Open the other bucket
Results:
- It should not show the previous bucket content anymore
- It should not show an empty 2nd column either
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
## Context
Follow up from https://github.com/supabase/supabase/pull/43329, but
mutually exclusive
Just cleaning up feature flags that have been toggled on for all users
and unchanged for the past 2 months
- edgefunctionreport
- storagereport
- realtimeReport
- postgrestreport
- authreportv2
- newEdgeFunctionOverviewCharts
- apiReportCountries (Already not used)
- SentryLogDrain
- reportGranularityV2
- storageAnalyticsVector
- ShowIndexAdvisorOnTableEditor
## Context
Main fix is to adjust the new home page + connect dialog (and connect
sheet) to render the project's custom domain if available
<img width="471" height="255" alt="image"
src="https://github.com/user-attachments/assets/3a208b2e-bdeb-43f5-a2e7-3495881dbaaa"
/>
<img width="1065" height="233" alt="image"
src="https://github.com/user-attachments/assets/2a7b8f81-8c0b-4803-bf0a-fc16a2f1e0e1"
/>
## Changes involved
- Created a `useProjectApiUrl` hook that will return the API URL
depending if custom domains is available, otherwise default to default
project API URL
- Refactored all the other places that were manually deriving the
project's endpoint
- Storage Explorer -> copy URL
- Edge Functions
- Integrations -> Data API + API Docs
- Auth Providers -> Callback URL
- Also updated the copy CTA for the addons page
- Instead of just "Change xxx", make it a bit more actionable
- For add ons with binary states (Custom domains, IPv4)
- If not enabled yet, "Enable xxx", otherwise "Toggle xxx"
- For PITR
- If not enabled yet, "Enable PITR", otherwise "Change recovery
duration"
- Also added "Edit custom domain" CTA if enabled
<img width="1144" height="518" alt="image"
src="https://github.com/user-attachments/assets/4f152ea5-0cc7-412c-95e8-ad5bb37c19c3"
/>
## To test
- [ ] Verify that for a project with custom domain set up, all the
affected UI mentioned in the above section look correct
Refactor
## What is the current behavior?
Many utility functions are in the Valtio object which is overly large
and complex.
## What is the new behavior?
Some utility functions are moved out and tested. No behaviour has been
changed, they've just been moved with any necessary changes to
arguments.
This pull request refactors how the `TabsStateContextProvider` receives
the project reference and updates related imports for consistency and
maintainability. The main change is to pass `projectRef` explicitly as a
prop instead of fetching it internally, which improves context control
and makes the component easier to test and reuse. Additionally, the PR
updates import paths to use absolute aliases and removes an unused
function.
This fixes an issue which you can replicate by:
1. Go to SQL editor
2. Open any snippet
3. Delete the local storage `supabase_studio_tabs_{project ref}`
4. Refresh the page while still the snippet is open
This will make the snippet to enter in a ghost state where the tab name
is not visible but you see the content.
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
## Context
Renaming folders on the Storage Explorer has a tendency to be flaky as
we're using the `POST /objects/move` storage API to move files to the
renamed folder which handles one file per request.
For a big folder (e.g 100+ files), users will easily hit rate limits and
run into 429s with the API, in which the current behaviour just shows
toast errors as the error handler, leaving an odd state upon running
through every file in the folder where some files are in the old folder,
and others in the new one
## Changes involved
Main solution is to implement an automatic retry logic for
`renameFolder`, but changes involved are:
- Remove batching logic for renaming folders (Which fires `n` requests
per batch)
- The batch logic was negligible anyways since our batch size was only 2
😅
- Instead we now handle moving of files sequentially
- If a file runs into an error during the `POST` request, retry the
request after `n` seconds
- If the error was a 429, retry after 60 seconds, otherwise just 5
seconds
- Will attempt the request for a total of 3 times
- Toast progress description will also be updated to show the message
(timer will also count down to keep the UI interactive and not look
stuck)
<img width="362" height="98" alt="image"
src="https://github.com/user-attachments/assets/52ba685a-2f35-42f1-8fcf-98351184fd56"
/>
- After the whole process is completed, if any file ran into an error,
toast description will add a CTA to retry the rename
## Demo
https://github.com/user-attachments/assets/d65b3c22-f9f8-4984-9521-6fc83a69f82e
## To test
Have a folder in your project's storage bucket with 100+ files (can
stress test with nested folders)
- [ ] Verify that you can rename the folder, and the dashboard
automatically handles errors
This pull request standardizes the usage of props and value types for
the `ResizablePanelGroup` and `ResizablePanel` components across
multiple files in the codebase. Specifically, it replaces the deprecated
`direction` prop with `orientation`, and updates numeric prop values
(such as `defaultSize`, `minSize`, and `maxSize`) to be passed as
strings. This ensures consistency with the updated component API and
improves type safety.
**Component API Updates:**
* Replaced the `direction` prop with `orientation` for all usages of
`ResizablePanelGroup`
* Updated all `ResizablePanel` props (`defaultSize`, `minSize`,
`maxSize`) to be passed as strings instead of numbers, ensuring
compatibility with the latest API requirements.
* Removed deprecated or unnecessary props such as `order` from
`ResizablePanel` components, and ensured all size-related props are
consistently formatted as strings.
- EditorPanel can now load, save, and rename SQL snippets inline
- New SaveSnippetDialog component for saving snippets with AI-generated
titles
- EditorPanel state tracks active snippet ID and pending reset
- EditQueryButton opens the inline editor panel instead of navigating to
SQL editor page
- AIEditor exposes onMount callback for editor instance access
- SnippetDropdown label updated to "Create snippet"
## TO TEST
### Normal CRUD
- open inline SQL Editor
- try creating a new snippet
- try editing an existing snippet
### Homepage V2 Report
- Try adding a new block → create snippet
- create the snippet in inline sql editor
- select the snippet in the report block section
This pull request refactors and improves error handling in the
`createStorageExplorerState` function within
`apps/studio/state/storage-explorer.tsx`. The changes make the switch
statement more robust and readable by introducing block scoping for each
case and handling additional error scenarios with more specific
messages.
* Refactored the switch statement to use block scoping (`{}`) for each
case, improving readability and preventing variable leakage between
cases.
* Enhanced the handling of HTTP 400 errors by checking the response body
for specific error messages, and displaying more precise error toasts
for "Invalid key" and "Invalid Compact JWS" cases.
* Added a default case to the switch statement to catch and display any
other error messages not explicitly handled, ensuring users receive
feedback for unexpected errors.
Enables Braintrust tracing for AI Assistant chats to support debugging
and future online evals.
**Code Changes**
- Wraps `generateAssistantResponse` in a Braintrust `traced()` span,
logging the user's latest message as input along with metadata
(`chatId`, `chatName`, `projectRef`, `userId`, `orgId`, `planId`, etc.)
- Threads JWT claims from `apiWrapper` → handler to log `userId` in
Braintrust without an extra API call (+ expanded `apiWrapper` tests)
- Threads `orgId` and `planId` from `getOrgAIDetails` to log in
Braintrust
**Infrastructure Changes**
- Created a "Vercel" service account in Braintrust
- Added `BRAINTRUST_API_KEY` and `BRAINTRUST_PROJECT_ID` env vars to the
studio-staging project in Vercel using a service token for the above
service account
- Added an "Overview" view to the Logs tab in the Braintrust Assistant
project to surface the new metadata
**Precautions**
- HIPAA sensitive projects are excluded from logging (see
https://github.com/supabase/supabase/pull/42787 for the detection logic)
- Production is temporarily excluded from logging until we're confident
in the setup
**Testing steps**
- Chat with the AI Assistant in the [studio-staging preview
build](https://github.com/supabase/supabase/pull/42963#issuecomment-3917178023)
below
- Visit the [Logs tab in the Braintrust Assistant
project](https://www.braintrust.dev/app/supabase.io/p/Assistant/logs)
and inspect the trace
<img width="4680" height="962" alt="CleanShot 2026-02-18 at 17 43 55@2x"
src="https://github.com/user-attachments/assets/c3a11b21-4e7f-4e90-bdab-a25ab8ee0d1f"
/>
<img width="2632" height="1288" alt="CleanShot 2026-02-18 at 17 45
04@2x"
src="https://github.com/user-attachments/assets/6c7b6ebc-5090-4ede-8f71-859ff7e386aa"
/>
**References**
- https://www.braintrust.dev/docs/integrations/sdk-integrations/vercel
- https://www.braintrust.dev/docs/instrument/custom-tracing
Closes AI-438
## Context
Related to this previous PR
[here](https://github.com/supabase/supabase/pull/42321)
Table Editor: Adding a CTA to the `HighQueryCost` UI to allow users to
proceed with fetching data despite the high query cost warning, to
prevent completely blocking the users from their workflows (realised
that certain heavy queries are required and this safeguard shouldn't be
creating dead-ends for users)
<img width="1159" height="264" alt="image"
src="https://github.com/user-attachments/assets/5fa01f7f-4442-4349-91f2-f4275e177f89"
/>
Clicking "Load more" will open a confirmation dialog, in which
proceeding to load the data will thereafter suppress this preflight
check for the table, for the rest of the browser session
<img width="450" height="305" alt="image"
src="https://github.com/user-attachments/assets/d3197a5d-a861-47a8-95da-e157972ce092"
/>
## Other changes
- Also bumped the query cost threshold from 100,000 to 200,000 - the
former might have been too aggressive 😓
- (Unrelated) Added query cost tooltip for cron jobs high query cost
warning
<img width="450" height="230" alt="image"
src="https://github.com/user-attachments/assets/d2c66972-7c4c-4f99-818c-e90a0991c2f5"
/>
This pull request introduces improvements to the handling of storage
endpoints in the Studio app, ensuring that storage operations utilize
the correct endpoint and enhancing maintainability through import path
updates and code clarity. The most significant changes are grouped
below:
**Storage Endpoint Handling:**
* The `useProjectEndpointQuery` hook now returns both `clientEndpoint`
and `storageEndpoint`, allowing storage operations to use a dedicated
endpoint when available.
* In the `StorageExplorerStateContextProvider`, the logic for
constructing the resumable upload URL now prefers `storageEndpoint` if
present, falling back to `clientEndpoint` otherwise. This ensures
uploads use the most appropriate endpoint.
* The context provider now sets `clientEndpoint` to `storageEndpoint`
when available, further aligning storage requests with the correct
endpoint.
* The dependency array for the provider effect now includes
`storageEndpoint`, ensuring state updates when the storage endpoint
changes.
**Code Quality and Maintainability:**
* Import paths in `storage-explorer.tsx` have been updated to use alias
(`@/`) references, improving clarity and maintainability. Type-only
imports are also used where appropriate, reducing bundle size and
potential circular dependencies.
**Code Clarity:**
* Added comments to chunk size calculations in the upload logic,
clarifying the rationale behind chunk sizing for different file sizes.
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Completion of batch edits on the table editor
## Demo
https://github.com/user-attachments/assets/ab5a7112-3dcc-456a-a5fc-1c9a99fccf34
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Queued add/edit/delete operations with optimistic UI, conflict
resolution, and queue-based flows
* Side-panel items showing queued add/delete row previews
* **UI**
* Pending-add placeholders plus a visible "DEFAULT" marker in grid cells
* Visual row states: green for pending adds, red with strike-through for
pending deletes
* Queue-based deletes can bypass confirmation when queue mode is enabled
* **Tests**
* Expanded tests covering queue conflict resolution and queue utilities
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <a@alaisteryoung.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
For the new AI filters we should take a totally different approach.
Rather than using the URL as the source of truth, it should rather act
as a secondary state store. The first being local state in Snap that
gets loaded from the URL. By forcing this clear line we can always make
sure the URL is backed up with the right values and ensure state is
updated quickly.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Toggleable next‑gen filter bar with lifecycle that initializes and
syncs filters to the URL.
* Centralized filter API in table state for setting, clearing, and
sharing filters across components.
* **Improvements**
* Grid queries are project‑scoped, use placeholder previous data, and
reapply optimistic updates on refresh.
* Added MS SQL sorting warning and feature‑flag controls for
queue/operation behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Testing
- Make sure the old filters still work as expected
- Enable the new Headers, test out new filters approach (count is still
broken FYI, will fix that later)
## Context
Just adding some documentation to the more complex parts of the
dashboard in hopes to ease working on these parts for those who aren't
familiar
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Folder creation and updates in the SQL Editor now properly sync to the
backend with API calls, success notifications, and improved error
handling.
* Snippet save/upsert behavior updated: saves run via API with
optimistic handling and debounced execution; default automatic refresh
after save has been reduced to avoid unnecessary invalidations.
* **Documentation**
* Added a comprehensive SQL Editor guide covering UI, data flow, snippet
management, and improvement notes.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
TBD
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* OS-aware modifier-key label shown in UI (⌘ on macOS, Ctrl+ on others)
* Tooltips added to operation queue actions for improved usability
* **Bug Fixes**
* Warns before applying non-primary-key sorts on large tables
* Clarified access error messages for organizations and projects
* **Refactor**
* Redesigned hotkey handling and operation-queue shortcuts
* Operation queue view toggle and save flow refined (panel auto-closes
after save)
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
Related to this PR
[here](https://github.com/supabase/supabase/pull/42265)
If you were to update a cell twice, then save, the value that get's
saved is the first edited value.
There's a number of changes in this PR but the main thing is just
`useOperationQueueActions` to declare `operations` outside of
`handleSave` since `snap` wouldn't trigger the re-render of that
function in the dependency array.
## Other changes
- Refactored `useOperationQueueShortcuts.ts`
- Reuse an existing `useHotKey` method to handle the event listeners
- Remove unnecessary prop drilling, call the necessary hooks within it
instead
- Simplify its calling by only calling this hook within
`SaveQueueActionBar` (removed calling from `OperationQueueSidePanel`
- Add tooltip for OperatioItem "Remove operation"
- (Unrelated) Fix Table Editor sort "Apply sort" CTA not working for
large tables when applying sort on an indexed column (e.g primary key)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Operation queue view now toggles open and closed with a single action
* Simplified keyboard shortcuts: press **S** to save operations, **.**
to toggle the queue view
* **Bug Fixes**
* Sort operations on large tables with non-primary-key sorting now show
a confirmation warning and require explicit user approval before
applying
* **Improvements**
* Operation queue panel automatically closes after successfully saving
operations
* Enhanced UI with improved delete action feedback and refined visual
separators
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
* Validate against empty name in FileExplorerRowEditing.tsx
* Update test
* Fix
* Opt to revert changes if saving empty string
* Nit
* Attempt to write tests with claude
* Trim whitespace in FileExplorerRowEditing when saving
* wip: explain tab in results editor
* updated to add sql explain
* updated to default back to results
* updated explain function
* updated case with multiple statements
* updated to reset explain query results
* added tests for semi colon comments
* feature: add explain w/ AI on pretty-explain tab (#41588)
* wip: added explain with AI
* wip: updated header with new buttons
* updated prompt
* remove any types
* removed unused flag
* updated header
* formatted code
* Use the .sql suffix when generating ids.
* Fix a bug where a new snippet would not show up in the snippet list until refresh.
* Add API routes which serve file snippets.
* Refactor the renameSnippet and moveSnippet to work with file snippets.
* Change the link to the SQL Editor.
* Minor fixes from CodeRabbit.
* Check the file/folder name for invalid chars.
* More fixes from CodeRabbit review.
* Fix minor issues.
* Use zod to parse the snippet ids when deleting.
* Try to fix snyk issue.
* Add validation to the GET content index route.
* Minor fixes.
* Show create a new folder, it was hidden by mistake.
* Add SNIPPETS_MANAGEMENT_FOLDER env var.
* Add snippets folder in the docker-compose.
* Add error toasts if the env var is not set.
* Add snippets management folder to the generateLocalEnv script.
* Revert the docker-compose changes, will be done in a followup PR.
* Revert also the snippets volume folder.
* Remove unneeded line.
* Possible solution with building the URL from local storage.
* Refactor the local storage for tabs to use table ids.
* Fix the saving table state to local storage.
* Minor fixes.
* Open the correct schema when following the link.
* Minor fixes from CodeRabbit.
* Address charis' feedbacks
* Clean
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
* Hide favorite and share actions for self-hosted version.
* Rename the query on save only on platform.
* Simplify useCheckOpenAiKeyQuery.
* Rename with AI now depends if the OPENAI_API_KEY is set.
* Minor fixes.
* Fix the tests to use .skip for skipping tests. Remove extra port params.
* Make the test for favourites work only on platform variant.
* added table advisor query
* updated to include table editor performance
* updated JSON B
* added side panel
* updated query indexes to show highlights context
* show index advisor in table editor
* updated invalidation logic
* added color updates
* added query indexes
* updated query performance type
* updated overflow and title
* put behind flag
* remove gap
* added on close
* Update apps/studio/data/database/table-index-advisor-query.ts
Co-authored-by: Charis <26616127+charislam@users.noreply.github.com>
* updated styling
---------
Co-authored-by: Charis <26616127+charislam@users.noreply.github.com>
* Bump the deps, refactor deprecated code.
* Migrate keepPreviousData usage.
* Migrate all uses of InfiniteQuery.
* Fix refetchInterval in queries.
* Migrate all use of isLoading to isPending in mutations.
* Fix accessing location in claim-project.
* Fix a bug in duplicate query keys.
* Migrate all queries to use isPending.
* Revert "Fix accessing location in claim-project."
This reverts commit 2a07df64b5.
* Revert the rss.xml file to master.
* Remove the query for temp keys. Remove the query for supabase client. Add a function which creates a supabase client with a temp key.
* Add a new query for building the endpoint URL.
* Migrate all oAuth queries and mutations to use the new function for creating a Supabase project client.
* Use the new queries/mutations in the code.
* Use query in refetchInterval for useProjectSettings.
* Replace all uses in StorageExplorer with createProjectSupabaseClient.
* added ability to download files from storage api directly
* updated to rechange size
* updated test methods
* updated test suite
* updated tests
* updated to remove loops
* removed AI slop
* Updated to use single API key in mem
* Fix the memoization of the getOrRefreshTempApiKey function.
* updated imports
* updated imports
* updated to use import meta
---------
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
Continues on from a0afa9e, reducing the number of unnecessary requests made when table changes are saved.
Currently, when you open the "Edit table" side panel, make zero changes, and click "Save", an unnecessary request runs to:
- Alter the table's comment to its existing comment
- Alter the table's schema to its existing schema
- Alter the table's RLS enable status to its existing RLS enable status
This PR changes the payload so we only alter what has actually changed. It also adds some refactoring to define clearer types and add type safety for the three possible kinds of table save actions (create new, duplicate, update existing).
After this, there are still a few unnecessary column update actions happening on array columns; those will be fixed in a final PR.
* default filters and state fix
* add created at
* text color
* small simplification
* always unregister sidebar
---------
Co-authored-by: Alaister Young <a@alaisteryoung.com>
Charis